pi-anthropic-oauth 0.1.14 → 0.1.16

package/README.md

@@ -1,15 +1,15 @@
 # pi-anthropic-oauth
 
-[![npm](https://img.shields.io/npm/v/pi-anthropic-oauth?style=flat-square&logo=npm&logoColor=white&label=npm&color=7c3aed)](https://www.npmjs.com/package/pi-anthropic-oauth) [![node](https://img.shields.io/badge/node-%3E%3D18-7c3aed?style=flat-square&logo=nodedotjs&logoColor=white)](https://nodejs.org)
+[![npm](https://img.shields.io/npm/v/pi-anthropic-oauth?style=flat-square&logo=npm&logoColor=white&label=npm&color=7c3aed)](https://www.npmjs.com/package/pi-anthropic-oauth)
 
 Use Claude Pro/Max in Pi with browser OAuth.
 
 ## Features
 
-- Claude Pro/Max login from `/login anthropic`
+- Claude Pro/Max login from `/login`
 - Automatic token refresh
 - Claude Code-compatible OAuth headers and prompt shaping
-- No API key or extra usage needed.
+- No Anthropic API key needed
 - Uses Pi's Anthropic model registry
 - Adds Claude Opus 4.8 by default
 - Auto-creates `~/.Claude Code` → `~/.pi` symlink when missing
@@ -20,10 +20,10 @@ Use Claude Pro/Max in Pi with browser OAuth.
 pi install npm:pi-anthropic-oauth
 ```
 
-Start Pi, then run:
+Start Pi, then run Pi's login command:
 
 ```text
-/login anthropic
+/login
 ```
 
 Choose:
@@ -32,12 +32,47 @@ Choose:
 Claude Pro/Max
 ```
 
-> [!WARNING]
-> Use at your own risk. This may go against Anthropic's terms.
+Complete the browser login. After login, select an Anthropic model in Pi.
+
+Update with:
+
+```bash
+pi update npm:pi-anthropic-oauth
+```
 
 > [!NOTE]
 > Anthropic auth changes are closely monitored for quick compatibility updates.
 
+## System prompt rewriting
+
+When using Claude Pro/Max OAuth, the extension prepends Claude Code identity text and rewrites standalone `Pi` / `pi` references in Pi's system prompt to `Claude Code`. The rewrite mode defaults to `aggressive`:
+
+```bash
+PI_ANTHROPIC_OAUTH_REWRITE_MODE=aggressive
+```
+
+Other modes are opt-in and avoid rewriting some technical strings such as paths, package names, or repository names. If OAuth starts failing, switch back to `aggressive`.
+
+Available modes:
+
+| Mode             | Behavior                                                                                                    |
+| ---------------- | ----------------------------------------------------------------------------------------------------------- |
+| `aggressive`     | Default. Replaces standalone `Pi` / `pi` wherever the word-boundary pattern matches.                        |
+| `path-safe`      | Avoids replacing `Pi` / `pi` immediately after `/` or `\`, preserving path segments like `/srv/dev/pi-foo`. |
+| `technical-safe` | Avoids replacing `Pi` / `pi` next to common technical-token separators: `/`, `\`, `.`, `@`, `:`, `_`, `-`.  |
+| `custom`         | Uses `PI_ANTHROPIC_OAUTH_REWRITE_PATTERN` as the replacement regex.                                         |
+
+Custom patterns can be a regex source or a JavaScript-style regex literal. The `g` flag is added automatically when omitted:
+
+```bash
+PI_ANTHROPIC_OAUTH_REWRITE_MODE=custom
+PI_ANTHROPIC_OAUTH_REWRITE_PATTERN='(?<![/\\])\b[Pp]i\b'
+# or
+PI_ANTHROPIC_OAUTH_REWRITE_PATTERN='/\bpi\b/gi'
+```
+
+There is no separate off mode. If you need to disable rewriting entirely, use a custom pattern that never matches, such as `(?!)`. Disabling or weakening the rewrite may affect OAuth compatibility.
+
 ## Extra models
 
 To add another Anthropic model, create `~/.pi/agent/models.json`:
@@ -47,7 +82,7 @@ To add another Anthropic model, create `~/.pi/agent/models.json`:
   "providers": {
     "anthropic": {
       "baseUrl": "https://api.anthropic.com",
-      "apiKey": "REQUIRED_BY_PI_FOR_CUSTOM_MODELS",
+      "apiKey": "unused",
       "api": "anthropic-messages",
       "models": [
         {
@@ -61,12 +96,17 @@ To add another Anthropic model, create `~/.pi/agent/models.json`:
 ```
 
 > [!NOTE]
-> Pi requires `baseUrl`, `apiKey`, and `api` when defining custom models in `models.json`. With this extension, requests normally authenticate through Claude Pro/Max OAuth after `/login anthropic`, so `apiKey` is present to satisfy Pi's config requirements and does not need to be a valid Anthropic API key.
+> Custom models are not needed for Claude Opus 4.8; this extension registers `claude-opus-4-8` automatically.
+>
+> Pi requires `baseUrl`, `apiKey`, and `api` when defining custom models in `models.json`. With this extension, requests normally authenticate through Claude Pro/Max OAuth after `/login`, so `apiKey` is only a placeholder to satisfy Pi's config requirements and does not need to be a valid Anthropic API key.
+>
+> Do not use a fake `sk-ant-oat...` value as the placeholder. If OAuth login has not completed, Pi may try to use that fake token and Anthropic will return `401 Invalid bearer token`. Use a harmless placeholder such as `"unused"`, then run `/login` and choose `Claude Pro/Max`.
 
 ## Troubleshooting
 
-- Re-run `/login anthropic` if auth looks stale
+- Run `/login` with no arguments, then choose `Claude Pro/Max`.
 - If local callback login does not complete, paste the final callback URL or `code#state` when prompted
+- If you see `401 Invalid bearer token`, remove any fake `sk-ant-oat...` placeholder from `~/.pi/agent/models.json` and log in again
 - If something breaks, please open an issue with your Pi version, extension version, and error output
 
 ## License

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-anthropic-oauth",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "Claude Pro/Max OAuth extension for Pi",
   "type": "module",
   "license": "MIT",
@@ -25,8 +25,9 @@
   },
   "scripts": {
     "check": "tsc -p tsconfig.json --noEmit",
+    "test": "node -e \"require('node:fs').rmSync('.test-dist', { recursive: true, force: true })\" && tsc -p tsconfig.json --outDir .test-dist && node --test test/*.test.mjs",
     "pack:check": "npm pack --dry-run",
-    "prepublishOnly": "npm run check && npm run pack:check"
+    "prepublishOnly": "npm run check && npm test && npm run pack:check"
   },
   "pi": {
     "extensions": [

package/src/prompt.ts

@@ -6,6 +6,25 @@ const PI_REMOVAL_ANCHORS = [
   "badlogic/pi-mono",
 ] as const;
 
+export const PI_REWRITE_MODE_ENV = "PI_ANTHROPIC_OAUTH_REWRITE_MODE";
+export const PI_REWRITE_PATTERN_ENV = "PI_ANTHROPIC_OAUTH_REWRITE_PATTERN";
+
+export type PiRewriteMode = "aggressive" | "path-safe" | "technical-safe" | "custom";
+
+const DEFAULT_PI_REWRITE_MODE: PiRewriteMode = "aggressive";
+const PI_REWRITE_PATTERN_SOURCES: Record<Exclude<PiRewriteMode, "custom">, string> = {
+  aggressive: String.raw`\b[Pp]i\b`,
+  "path-safe": String.raw`(?<![/\\])\b[Pp]i\b`,
+  "technical-safe": String.raw`(?<![/\\.@:_-])\b[Pp]i\b(?![/\\.@:_-])`,
+};
+
+const PI_REWRITE_MODES = new Set<PiRewriteMode>([
+  "aggressive",
+  "path-safe",
+  "technical-safe",
+  "custom",
+]);
+
 type MessageContentBlock = {
   type: string;
   text?: string;
@@ -42,7 +61,10 @@ export function buildAnthropicSystemPrompt(
   return blocks.length > 0 ? blocks : undefined;
 }
 
-function sanitizeSystemText(text: string): string {
+export function sanitizeSystemText(
+  text: string,
+  env: NodeJS.ProcessEnv = process.env,
+): string {
   const paragraphs = text.split(/\n\n+/);
   const filtered = paragraphs.filter((paragraph) => {
     const lower = paragraph.toLowerCase();
@@ -52,7 +74,56 @@ function sanitizeSystemText(text: string): string {
 
   return filtered
     .join("\n\n")
-    .replace(/\bpi\b/g, "Claude Code")
-    .replace(/\bPi\b/g, "Claude Code")
+    .replace(resolvePiRewritePattern(env), "Claude Code")
     .trim();
 }
+
+function resolvePiRewritePattern(env: NodeJS.ProcessEnv): RegExp {
+  const mode = parsePiRewriteMode(env[PI_REWRITE_MODE_ENV]);
+  if (mode === "custom") return compileCustomPiRewritePattern(env[PI_REWRITE_PATTERN_ENV]);
+  return new RegExp(PI_REWRITE_PATTERN_SOURCES[mode], "g");
+}
+
+function parsePiRewriteMode(value: string | undefined): PiRewriteMode {
+  if (!value?.trim()) return DEFAULT_PI_REWRITE_MODE;
+  const mode = value.trim().toLowerCase();
+  if (PI_REWRITE_MODES.has(mode as PiRewriteMode)) return mode as PiRewriteMode;
+  throw new Error(
+    `Invalid ${PI_REWRITE_MODE_ENV}: ${value}. Expected one of ${Array.from(PI_REWRITE_MODES).join(", ")}.`,
+  );
+}
+
+function compileCustomPiRewritePattern(value: string | undefined): RegExp {
+  const pattern = value?.trim();
+  if (!pattern) {
+    throw new Error(`${PI_REWRITE_PATTERN_ENV} must be set when ${PI_REWRITE_MODE_ENV}=custom.`);
+  }
+
+  const parsed = parseRegexLiteral(pattern) ?? { source: pattern, flags: "" };
+  const flags = parsed.flags.includes("g") ? parsed.flags : `${parsed.flags}g`;
+  try {
+    return new RegExp(parsed.source, flags);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Invalid ${PI_REWRITE_PATTERN_ENV}: ${message}`);
+  }
+}
+
+function parseRegexLiteral(value: string): { source: string; flags: string } | undefined {
+  if (!value.startsWith("/")) return undefined;
+
+  for (let index = value.length - 1; index > 0; index--) {
+    if (value[index] !== "/" || isEscaped(value, index)) continue;
+    return { source: value.slice(1, index), flags: value.slice(index + 1) };
+  }
+
+  return undefined;
+}
+
+function isEscaped(value: string, index: number): boolean {
+  let slashCount = 0;
+  for (let cursor = index - 1; cursor >= 0 && value[cursor] === "\\"; cursor--) {
+    slashCount++;
+  }
+  return slashCount % 2 === 1;
+}

package/src/stream.ts

@@ -24,7 +24,12 @@ import { buildAnthropicSystemPrompt } from "./prompt.js";
 const REQUIRED_BETAS = [
   "claude-code-20250219",
   "oauth-2025-04-20",
-  "fine-grained-tool-streaming-2025-05-14",
+  // fine-grained-tool-streaming removed: it ships the model's raw, unvalidated
+  // tool-input JSON. For large edits full of quotes/newlines the streamed
+  // string escaping breaks, so a field (e.g. edit.oldText) swallows the rest of
+  // the structure — surfacing as either a hard JSON.parse crash or a wrong-shape
+  // schema-validation failure. Default streaming has the server validate/buffer
+  // tool JSON, guaranteeing well-formed, correctly-structured input.
   "interleaved-thinking-2025-05-14",
 ] as const;
 
@@ -43,6 +48,14 @@ function mapStopReason(reason: string | null | undefined): StopReason {
   }
 }
 
+function headersToRecord(headers: Headers): Record<string, string> {
+  const record: Record<string, string> = {};
+  headers.forEach((value, key) => {
+    record[key] = value;
+  });
+  return record;
+}
+
 function makeDefaultHeaders(
   isOAuth: boolean,
   options?: SimpleStreamOptions,
@@ -57,10 +70,7 @@ function makeDefaultHeaders(
     headers["user-agent"] = USER_AGENT;
     headers["x-app"] = "cli";
   } else {
-    headers["anthropic-beta"] = [
-      "fine-grained-tool-streaming-2025-05-14",
-      "interleaved-thinking-2025-05-14",
-    ].join(",");
+    headers["anthropic-beta"] = ["interleaved-thinking-2025-05-14"].join(",");
   }
 
   if (options?.headers) {
@@ -118,7 +128,9 @@ export function streamAnthropicOAuth(
     try {
       const apiKey = options?.apiKey;
       if (!apiKey) {
-        throw new Error("No Anthropic auth available. Run /login anthropic.");
+        throw new Error(
+          "No Anthropic auth available. Run /login and choose Claude Pro/Max.",
+        );
       }
 
       const isOAuth = isClaudeOAuthAccessToken(apiKey);
@@ -170,9 +182,32 @@ export function streamAnthropicOAuth(
         };
       }
 
-      const anthropicStream = client.messages.stream(params, {
-        signal: options?.signal,
-      });
+      // Raw stream instead of the MessageStream helper: MessageStream
+      // accumulates tool_use input and JSON.parses it on content_block_stop,
+      // which throws under fine-grained-tool-streaming (input may be invalid
+      // mid-flight) and aborts the turn. The raw stream yields the same
+      // RawMessageStreamEvents; tool args are already parsed leniently below.
+      const { data: anthropicStream, response: httpResponse } =
+        await client.messages
+          .create(params, {
+            signal: options?.signal,
+          })
+          .withResponse();
+
+      if (options?.onResponse) {
+        try {
+          await options.onResponse(
+            {
+              status: httpResponse.status,
+              headers: headersToRecord(httpResponse.headers),
+            },
+            model,
+          );
+        } catch {
+          // Response hooks are best-effort and should not break streaming.
+        }
+      }
+
       stream.push({ type: "start", partial: output });
 
       const blocks = output.content as IndexedBlock[];